Pat Breen (Clare, Fine Gael) | Oireachtas source

Yes. Section 115 makes provision for a judicial remedy in the case of infringements of the GDPR. Article 80.2 of the GDPR recognises that a member state may allow in its national laws for a not-for-profit body, association or organisation to take action on behalf of a data subject without the data subject's mandate. However, that is not part of our law and compliance with the GDPR does not require such a provision.

The restrictions in the Bill on the taking of compensation claims by a not-for-profit body, association or organisation is understandably intended to discourage speculative compensation claims, especially where the data subject will be relieved of any risk that costs of the action might be awarded against him or her. There are sound public policy reasons for discouraging the growth of a compensation culture in respect of data protection claims, which is reflected in the Bill's provisions. As Deputy Wallace may be aware, there is already concern at the level of compensation claims, which is contributing to increasing insurance premiums and affecting business, especially SMEs. I am very conscious of this matter when I wear my other ministerial hat.

I cannot accept subsection (8) as proposed in amendment No. 155 or subsection (9) as proposed in amendment No. 157. The same applies to amendment No. 136, which seeks to make provision for the taking of action on behalf of a data subject without a mandate, or permission, from him or her. Deputy Wallace referred to amendment No. 156. I cannot accept it, as it would allow courts to award compensation to data subjects in cases taken under section 115 by a not-for-profit body, association or organisation on their behalf.

Regarding amendment No. 158, the position is that Article 55 of the directive, unlike the GDPR, does not provide for actions to be taken on behalf of data subjects without their permission. For this reason, I cannot accept the amendment, which would allow a not-for-profit body, association or organisation to take action on behalf of a data subject under section 118 without his or her permission. This is understandable, given that the data subject might have specific reasons for not wishing the case to be taken.

I cannot accept the proposed changes in amendments Nos. 172 and 173 to section 126 for the reasons already outlined in respect of the GDPR. That being the case, amendment No. 190, which proposes to amend section 146(1) in order to accommodate the withdrawal of complaints by a not-for-profit body, association or organisation that has not been mandated to act on behalf of a data subject, is not required.